linux-cve-announce - CVE-2025-38736: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025090544-CVE-2025-38736-b74b@gregkh>
Date: Fri,  5 Sep 2025 19:20:45 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38736: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

Syzbot reported shift-out-of-bounds exception on MDIO bus initialization.

The PHY address should be masked to 5 bits (0-31). Without this
mask, invalid PHY addresses could be used, potentially causing issues
with MDIO bus operations.

Fix this by masking the PHY address with 0x1f (31 decimal) to ensure
it stays within the valid range.

The Linux kernel CVE team has assigned CVE-2025-38736 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12.43 with commit ee2cd40b0bb46056949a2319084a729d95389386 and fixed in 6.12.44 with commit 22042ffedd8c2c6db08ccdd6d4273068eddd3c5c
	Issue introduced in 6.16.2 with commit ad1f8313aeec0115f9978bd2d002ef4a8d96c773 and fixed in 6.16.4 with commit 523eab02fce458fa6d3c51de5bb055800986953e
	Issue introduced in 6.17-rc2 with commit 4faff70959d51078f9ee8372f8cff0d7045e4114 and fixed in 6.17-rc3 with commit 24ef2f53c07f273bad99173e27ee88d44d135b1c
	Issue introduced in 6.15.11 with commit a754ab53993b1585132e871c5d811167ad3c52ff

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38736
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/usb/asix_devices.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fcb4ce9f729c1d08e53abf9d449340e24c3edee6
	https://git.kernel.org/stable/c/8f141f2a4f2ef8ca865d5921574c3d6535e00a49
	https://git.kernel.org/stable/c/748da80831221ae24b4bc8d7ffb22acd5712a341
	https://git.kernel.org/stable/c/22042ffedd8c2c6db08ccdd6d4273068eddd3c5c
	https://git.kernel.org/stable/c/523eab02fce458fa6d3c51de5bb055800986953e
	https://git.kernel.org/stable/c/24ef2f53c07f273bad99173e27ee88d44d135b1c